News · via Huntress
Defense Drill Interventions
Defense Drill Interventions pair Managed EDR with just-in-time SAT training, so users learn the moment they fall for ClickFix.
EDR
Coverage tagged "EDR".
News · via Flashpoint
DefenderKiller: How Vulnerable Drivers Are Being Abused to Disable Endpoint Security
Table Of ContentsTable of ContentsDefenderKiller Exploits a Legacy Microsoft DriverImplications for Endpoint SecurityIndicators of Compromise and Technical ArtifactsStay Ahead of EDR Evasion…
News · via Cisco Talos
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Phishing remained the leading initial access technique, appearing in slightly over one-third of all Cisco Talos Incident Response (Talos IR) engagements — a decrease from over 50 percent last quarter.
News · via ransomware.live
🏴☠️ Barracuda has just published a new victim : Femern Link Contractors
Femern Link Contractors (FLC) is an international joint venture responsible for designing and building the Fehmarnbelt tunnel between Denmark and Germany. Its work includes the immersed tunnel…
News · via Elastic Security Labs
Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform
Microsoft is building a way for EDR products to run outside the Windows kernel. It is called the Windows Endpoint Security Platform, and two of its binaries already ship in Windows Insider build. One…
News · via Halcyon
BYOVD Attacks: How Attackers Turn Signed Drivers Against Your EDR
Threat actors favor vulnerable drivers for bypassing security controls to create a shell, execute malware, and for persistence because they run with kernel-level privileges
News · via Google Threat Intelligence Group
Investigating Ephemeral Supply Chain Tampering
Written by: Tyler McLellan Introduction Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to…
News · via Security Affairs
Hunt.io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure
Hunt.io traced BraZetsu ‘s infrastructure and found that hosting patterns and certificate data remained useful after published IOCs became outdated. Group-IB researchers published a detailed writeup…
News · via Dark Reading
'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates
Not quite an EDR-killer, but the proof-of-concept cyber technique creates a silent virus detection gap while service runs normally, no exploit required.